Henner M. Kruse
17 lines
1.6 KiB
JSON
17 lines
1.6 KiB
JSON
{
|
|
"_comment": "Reference only — setup.sh generates and writes these exact rules itself, so this file is no longer read during setup. Kept here for auditing/documentation: this is what /obsidian-vault-kb:setup will add to your permissions.allow, with <SKILL_DIR> substituted for the real, symlink-resolved skills/obsidian-vault-kb path. Only the three read-only wrapper scripts are whitelisted, each pinned to its exact absolute path — no generic Bash(find:*), Bash(rg:*), Bash(cat:*), etc. The wrapper scripts themselves resolve the vault path only from ~/.agent-skills/obsidian-vault-kb/config.json and refuse to operate outside it, so whitelisting them does not grant filesystem access beyond the configured vault.",
|
|
"permissions": {
|
|
"allow": [
|
|
"Bash(<SKILL_DIR>/scripts/vault_index.sh:*)",
|
|
"Bash(<SKILL_DIR>/scripts/vault_search.sh:*)",
|
|
"Bash(<SKILL_DIR>/scripts/vault_backlinks.sh:*)",
|
|
"Read(~/.agent-skills/obsidian-vault-kb/config.json)"
|
|
],
|
|
"_deliberately_not_whitelisted": [
|
|
"No generic Bash(find:*), Bash(rg:*), Bash(grep:*), Bash(cat:*), Bash(sed:*), etc. — these would allow reading anywhere on the filesystem, not just the vault.",
|
|
"No write/append command targeting the vault or the config file — creating or editing config.json, and any 'append'/'maintain' mode writes into vault notes, keep prompting for confirmation each time by design.",
|
|
"No wildcard on the whole scripts/ directory — only the three specific script files are whitelisted, not the whole folder, so no other script could be dropped in and silently gain the same trust."
|
|
]
|
|
}
|
|
}
|